IoT Incident Response, Monitoring, and Governance
Domain 8 covers detecting an IoT compromise, containing it without destroying evidence or the process, and the governance that makes both repeatable across a fleet.
Detection
IoT telemetry is small and periodic, which makes baselining unusually effective. Monitor for new outbound destinations, protocol drift (a camera speaking SMB), fixed-interval beaconing with jitter, authentication failures spread across many device IDs, firmware hash mismatch, and configuration changes. Forward device logs to a SIEM by syslog over TLS or via the broker; constrained devices usually need an agentless collector or a gateway relay. Passive network monitoring through SPAN, TAP or flow records is safer than active scanning.
Containment, eradication, recovery
- Contain by network quarantine - 802.1X change of authorisation, NAC, VLAN move, broker ACL revocation - not by powering the device off, which destroys volatile evidence.
- Revoke the credential as well as the address: the device certificate, not just the IP.
- Capture volatile memory and logs before reflashing; constrained devices may retain only minutes of state.
- Recover by reflashing signed firmware, reprovisioning identity from a trusted root, verifying integrity, and watching for re-infection.
- Rotate everything the device could reach: broker keys, cloud IAM roles, shared secrets.
Governance
An asset inventory with named owners, an approved-device list, secure-by-default procurement requirements (NIST IR 8259 device capabilities, EU Cyber Resilience Act obligations), defined roles across OT engineering, security and vendors, and metrics such as time to patch, percentage of devices with unique credentials, and count of unmonitored devices. Close the loop with a post-incident review that changes the baseline rather than the slide deck.
Worked example
An HVAC controller begins beaconing to an unknown IP every 60 seconds. Reasoning: fixed-interval beaconing is a classic command-and-control signature, but a vendor update server can look identical, so check the destination against the approved egress allow-list and DNS history first. Action: quarantine the VLAN through NAC, revoke its certificate at the broker, capture memory and flow logs, check peer controllers for the same destination, reflash from a known-good signed image, and re-admit only through the allow-list.
Traps that cost marks
- Powering the device off first and losing volatile evidence.
- Reimaging without preserving logs, so root cause is never established.
- Containing the IP address but leaving the credential valid.
- Having no inventory, so the fleet-wide scope question cannot be answered.